Open a private service.

01 / START HERE

Choose what you want to reach.

If you want to connect to another device, use Devices in the app. If you want to open one private website, API, or database, follow this guide to create an Endpoint. You do not need an exit node.

Each Endpoint shares one chosen service. It does not open every port, grant Terminal or Files access, or route an entire subnet.

02 / INSTALL

Bring your Linux server online.

Run this on the Linux server with your Airmsh organization admin email. Inspect the installer first, or choose a manual package from Downloads. It selects the right build, checks the download, configures private device access, and enables the background service. An update keeps the server’s existing login.

curl -fsSL https://airmsh.com/install-cli.sh | sudo sh -s -- --email admin@example.com

Enter the password only when prompted in your terminal. Never put it in the command, a script, or a service file. Check the installed build and the service, then confirm the server appears Online in the app’s Devices page.

sudo airmsh-cli --version
sudo systemctl is-active airmsh-cli

The service should say active. If the installer could not prompt for a first login, run sudo airmsh-cli resource login admin@example.com interactively, then sudo systemctl start airmsh-cli. For errors, run sudo journalctl -u airmsh-cli -n 50 --no-pager. This setup does not open your service to the public internet.

03 / CREATE

Give one service a private address.

The Airmsh server connects to a service on itself or another host it can already reach. Airmsh gives that service a private name and port for approved clients. There is no exit node or whole-subnet route.

1. On the server, check that your website, API, or database already responds. For a service on that same server, 127.0.0.1:8000 is a typical local address.
2. In the app, open Endpoints → Administration → Create endpoint. Choose the online server. Enter Dashboard for the endpoint name, dashboard for the Private DNS name, 127.0.0.1:8000 for Service IP and port, and 8080 for the private port. Choose TCP for a website or API.
3. Save, then copy the complete address shown in Endpoints. On an approved device, connect Endpoint access from Home and open the copied address.

The example address is http://dashboard.company.internal:8080/ if your organization uses company.internal. Copy the actual name shown in Endpoints; creating one does not expose its port to the public internet.

04 / SHARE

Choose who can open it.

1. The teammate creates their own Airmsh account. As organization owner, open People & access → Invite person and enter their email. The form is labeled Add user.
2. Open Endpoints → Administration, select the Endpoint, and choose Access. Allow the intended user, group, or device. Organization owners and admins already have access unless explicitly denied.
3. The teammate signs in on their device, starts the private network, connects Endpoint access on Home, and opens the address from Endpoints.

05 / NAME

Use the address shown in the app.

AirDNS gives a device its own private name. An Endpoint gives one service a separate name, such as dashboard.company.internal. Your admin can choose the organization’s private namespace.

Copy the full Endpoint address, including its port, from the app. The name works only while Endpoint access is connected; it does not make the server’s other services or network reachable.

06 / OPTIONAL HTTPS

Use HTTPS when the service needs it.

If you use HTTP for a private test, you can skip this step. For an HTTPS website, the service itself needs a certificate for the exact private name. Airmsh encrypts the connection but does not turn HTTP into HTTPS or issue the website certificate.

1. Choose the Endpoint’s exact name, such as web-a.company.internal. Generate a private key on the service host and request a certificate for that name from your organization’s private certificate authority (CA). The certificate must include the name in its Subject Alternative Name.
2. Install the issued certificate and its private key on the HTTPS service, for example at 127.0.0.1:8443. Keep the key on that host.
3. In Endpoints → Administration, set private port 443, protocol TCP, and service address 127.0.0.1:8443. Connect Endpoint access on Home.
4. Trust the private CA’s public root certificate on each approved client, then open https://web-a.company.internal/. Never copy the CA signing key or service private key to clients.

curl --fail --show-error --verbose https://web-a.company.internal/

Certificate renewal can be automated by your private CA using ACME, but Airmsh does not issue, renew, or install certificates today. Your HTTPS service must reload a renewed certificate. Public certificate authorities cannot issue for a .internal name, so all clients must trust your private CA. Do not bypass certificate checks to make a failing connection appear to work.

07 / CHECK

Open it, then check who cannot.

1. From an approved device, connect Endpoint access on Home and open the copied address. The service should respond.
2. From a user without access, try the same address. It should not open. Terminal, Files, and other server ports remain separate.
3. Remove a user’s Endpoint access and check that they cannot start a new connection. Normal internet browsing should still use its usual route.

If it stays “Connecting”

Check that the server is online in Devices, then reconnect Endpoint access on Home. If only one Endpoint fails, check that service on the server.

If the address does not open

Copy the full name and port from Endpoints. If the name resolves but the page times out, check the service listener and the server’s firewall.

If the browser warns about HTTPS

Check the service certificate’s name and whether your device trusts its private CA. Do not bypass certificate warnings.